W
Vendor security profile
wintercms
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs9
Critical1
CISA KEV0
Public exploit0
Patch rate%100
Avg. CVSS6.9
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
9
0
0
CVE KEV
CVE severity distribution
9toplam CVE
Critical1 (11%)
High3 (33%)
Medium5 (56%)
Patch and exploitation view
%100
Verified patch
%0
CISA KEV
%0
Public exploit
9Patch available
0Partial
0Workaround
0Vendor: no patch
0Unknown
Latest vulnerabilities
4.9
CVE-2026-63179
Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets
W
Patch verifiedEPSS %1
5.4
CVE-2026-54256
Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata
W
Patch verifiedEPSS %0
6.8
CVE-2026-32639
Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads
W
Patch verifiedEPSS %0
5.9
CVE-2026-32593
Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax
W
Patch verifiedEPSS %0
8.1
CVE-2026-32258
Winter: Stored XSS through Editor Settings custom styles
W
Patch verifiedEPSS %0
8.1
CVE-2026-32257
Winter: Stored XSS through Brand Settings custom styles
W
Patch verifiedEPSS %0
7.1
CVE-2026-35445
Winter: Authenticated backend users can bypass Users controller permission checks
W
Patch verifiedEPSS %0
9.3
CVE-2026-79774
Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy
W
Patch verifiedEPSS %1
6.9
CVE-2026-79773
Winter CMS before 1.2.13 Local File Inclusion via JavaScript
W
Patch verifiedEPSS %0